D:\xwork_vs2015\RetentionSoftware\bin\broex_doctranslate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e2208d0439194f4cb72430ca99f17b6326b3fd778081779832ccf36d83955cb2.exe
Resource
win7-20241023-en
General
-
Target
e2208d0439194f4cb72430ca99f17b6326b3fd778081779832ccf36d83955cb2
-
Size
844KB
-
MD5
6963ffa2d20802e8510005cb9b02b212
-
SHA1
409d3bbb3f568828a3cc575bff38d8876391316d
-
SHA256
e2208d0439194f4cb72430ca99f17b6326b3fd778081779832ccf36d83955cb2
-
SHA512
f989ec2b2ac80ad044ff111a2fb0042b56e72e152f3c46e86d7ffdd265ef70dbc07bbaaddccc7f6524a1d23f81c7af9ca23b3a616569a1e19624e72d2f587420
-
SSDEEP
12288:MQ7nkmzIrVVyzxMP4S4WUa63HeeE9WJXvCnViXF9aZ6PKM:MQ7nXIhVy9MP3QuMXVXFY9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2208d0439194f4cb72430ca99f17b6326b3fd778081779832ccf36d83955cb2
Files
-
e2208d0439194f4cb72430ca99f17b6326b3fd778081779832ccf36d83955cb2.exe windows:5 windows x86 arch:x86
857afdf6d48cbb2777ecadd962c59b7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WideCharToMultiByte
CreateDirectoryW
FindFirstFileA
FindClose
GetPrivateProfileStringA
ReadFile
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetModuleHandleA
LoadLibraryA
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ExitProcess
GetCurrentProcess
LocalFree
GetCommandLineW
SetCurrentDirectoryW
VirtualFree
GetModuleFileNameW
HeapSize
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SleepEx
GetTickCount
WaitForSingleObject
FreeLibrary
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
SetLastError
FormatMessageA
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
WriteFile
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
DecodePointer
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
user32
GetWindowThreadProcessId
GetShellWindow
GetDesktopWindow
GetWindowRect
GetForegroundWindow
GetSystemMetrics
advapi32
CryptAcquireContextA
RegOpenKeyExW
RegCloseKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
shlwapi
PathRemoveFileSpecW
PathIsDirectoryW
ws2_32
WSAIoctl
socket
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
setsockopt
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
getaddrinfo
ntohs
wldap32
ord200
ord30
ord79
ord35
ord301
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord33
ord143
Sections
.text Size: 539KB - Virtual size: 538KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 97KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE